CVE-2026-8168CWE-674

CVE-2026-8168

published October 19, 2026

CVSS
7.1
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00404 · 33.5th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-10-19T18:17Z
References (11)
https://codereview.qt-project.org/c/qt/qtsvg/+/730501 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qtsvg/+/730590 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qtsvg/+/730591 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qtsvg/+/730892 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qtsvg/+/731257 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qtsvg/+/733245 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qtsvg/+/738811 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qtsvg/+/743488 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qtsvg/+/748966 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://codereview.qt-project.org/c/qt/qtsvg/+/756512 · a59d8014-47c4-4630-ab43-e1b13cbe58e3https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-8168: · a59d8014-47c4-4630-ab43-e1b13cbe58e3
EPSS history
Timeline
  • 21 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 19 OCT 13:08Z
    Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
    cvelistv5
  • 19 OCT 13:08Z
    Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
    cvelistv5